MESSAGE CLASSIFICATION USING LEGITIMATE CONTACT POINTS

• US 20120131119A1
• Filed: 01/30/2012
• Published: 05/24/2012
• Est. Priority Date: 02/20/2003
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Oliver, Jonathan J., Koblas, David A., Wilson, Brian K.
• Granted Patent: US 8,463,861 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06F 16/24558 Binary matching operations
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A system and method are disclosed for classifying a message. The method includes receiving the message, identifying all items of a certain type in the message, determining whether each of the items meets a criterion, and in the event that all the items are determined to meet the criterion, determining a classification of the message. The system includes an interface configured to receive the message, a processor coupled to the interface, configured to identify all items of a certain type in the message; determine whether each of the items meets a criterion; and in the event that all the items are determined to meet the criterion, determine a classification of the message.

Claims

1. A method for classifying a message, comprising:

receiving a message, the message including a distinguishing property;

executing instructions stored in a memory, wherein execution of the instructions by a processor;

parses the message body to determine that the distinguishing property includes a contact point that is used to classify the message, p1 reduces the contact point to an identifier that represents the contact point regardless of individual format of the contact point;

generates a signature based on the identifier; and

compares the generated signature to one or more previously generated signatures stored in a database of acceptable signatures.

2. The method of claim 1, wherein the execution of instructions by the processor further classifies the message as acceptable based on the generated signature having been previously stored in the database.

4. The method of claim 2, wherein the execution of instructions by the processor further updates the database through a registration process.

5. The method of claim 1, wherein the execution of instructions by the processor further:

parses the message to identify an additional contact point when the generated signature has not been previously stored in the database,

reduces the contact point to an identifier that represents the additional contact point regardless of individual format of each of the additional contact point,

generates a signature based on the identifier, and

compares the generated signature of the identifier to one or more previously generated signatures stored in a database of acceptable signatures.

6. The method of claim 1, wherein the contact point includes a universal resource locator (URL).

7. The method of claim 1, wherein the contact point includes a phone number.

8. The method of claim 1, wherein the contact point includes an address.

9. The method of claim 1, wherein generating the signature includes performing a function on characters associated with the contact point, the function selected from a group consisting of a hash function, checksum, compression, and expansion.

10. The method of claim 4, wherein the registration process includes:

receiving a registration message;

checking a certificate associated with the message, the certificate confirming that the registration message is from an acceptable source;

extracting an item from the message; and

adding an entry derived from the item to the database of acceptable items.

11. A system for classifying a message comprising:

in interface coupled to a mail server for receiving a message, the message including a distinguishing property;

a processor at the mail server for executing instructions stored in memory for performing the steps of;

parsing the message to determine that the distinguishing property includes a contact point that is used to classify the message;

reducing the contact point to an identifier that represents the contact point regardless of individual format of the contact point;

generating a signature based on the identifier; and

comparing the generated signature to one or more previously generated signatures stored in a database of acceptable signatures.

12. The system of claim 11, wherein the processor further classifies the message as acceptable based on the generated signature having been previously stored in the database.

14. A non-transitory computer readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for classifying a message, the message comprising:

receiving a message, the message including a distinguishing property;

parses the message to determine that the distinguishing property includes a contact point that is used to classify the message;

reduces the contact point to an identifier that represents the contact point regardless of individual format of the contact point;

generates a signature based on the identifier; and

compares the generated signature to one or more previously generated signatures.